Self-stabilizing Population Protocols

Transcription

1 Self-stabilizing Population Protocols Dana Angluin, James Aspnes, Michael J. Fischer and Hong Jiang Yale University This paper studies self-stabilization in networks of anonymous, asynchronously interacting nodes where the size of the network is unknown. Constant-space protocols are given for Dijkstra-style round-robin token circulation, leader election in rings, 2-hop coloring in degree-bounded graphs, and establishing consistent global orientation in an undirected ring. A protocol to construct a spanning tree in regular graphs using O(log D) memory is also given, where D is the diameter of the graph. A general method for eliminating nondeterministic transitions from the self-stabilizing implementation of a large family of behaviors is used to simplify the constructions, and general conditions under which protocol composition preserves behavior are used in proving their correctness. Categories and Subject Descriptors: C.2.4 [Computer-communication Networks]: Distributed Systems Distributed applications; B.8.1 [Performance; Reliability]: Reliability, Testing, and Fault-Tolerance General Terms: Algorithms, Reliability Additional Key Words and Phrases: Anonymous, fairness, finite-state, population protocols, selfstabilization, sensor networks 1. INTRODUCTION In some practical scenarios, a large and sometimes unknown number of devices are deployed over a region without fine control of their locations, communication and movement patterns. The devices are all indistinguishable and have only a few bits of memory each. Such scenarios are modeled by the population protocols introduced in [Angluin et al. 2006], where families of predicates computable in this model are explored. Graph properties computable in the same model are discussed in [Angluin et al. 2005]. Communication in population protocols occurs through pairwise interaction of anonymous finite-state nodes. The number of nodes is finite but unbounded. A communication graph describes which pairs of nodes A preliminary version of the present work appeared in the proceedings of the Ninth International Conference on Principles of Distributed Systems, December James Aspnes was supported in part by NSF grants CNS and CNS Hong Jiang was supported in part by NSF grant ITR Corresponding author: James Aspnes, 51 Prospect Street, New Haven, CT , U. S. A., james.aspnes@yale.edu, Telephone: , Facsimile: Permission to make digital/hard copy of all or part of this material without fee for personal or classroom use provided that the copies are not made or distributed for profit or commercial advantage, the ACM copyright/server notice, the title of the publication, and its date appear, and notice is given that copying is by permission of the ACM, Inc. To copy otherwise, to republish, to post on servers, or to redistribute to lists requires prior specific permission and/or a fee. c 20YY ACM /20YY/ $5.00 ACM Journal Name, Vol. V, No. N, Month 20YY, Pages 1 28.

2 2 Dana Angluin et al. may interact. In the theoretical literature on distributed computing, some variant of a weak fairness condition is usually assumed. Informally, in an infinite fair execution each process or node satisfying certain conditions is given a turn infinitely often. We call this definition local fairness. The environment/scheduler is viewed as a powerful adversary who can strategically determine the sequence in which processes are activated, as long as local fairness is preserved. Many impossibility results rely on this assumption. For instance, the impossibility of deterministic self-stabilizing token circulation in uniform rings [Dijkstra 1974] follows from the assumption that the scheduler can activate the nodes in a round-robin fashion, preserving symmetry while achieving local fairness. However, in practical distributed systems, such a powerful scheduler seldom exists. The global ordering of computational steps depends on a variety of elements. Temperature and power-supply affect the efficiency of electronic devices. Local clock frequency influences the progress of each node. For ad hoc networks, the movement of nodes determines possible sequences of interactions. Random delay is usually used in practical leader election and collision detection protocols, which can be viewed as a way to randomize the scheduling of the system. In the model of population protocols, an alternative fairness condition called global fairness is assumed, which better reflects the scheduling properties of many distributed systems. Global fairness puts more constraints on the scheduler, so problems proved impossible under global fairness are also impossible under local fairness. Global fairness also provides a simple conceptual framework for protocol design. For instance, once a task is known to be possible in our model, randomization techniques can be applied to make the protocol work under some weaker fairness conditions. The responsibility of many systems is to meet certain specifications for wellbehavedness such as avoidance of deadlock, fairness among processes, fault tolerance, and other global system properties that cannot be simply modeled as functional computation. We extend the model of population protocols to accommodate such tasks. We focus on self-stabilizing systems that can start in any global configuration and achieve behavior meeting the task specification by itself. Such systems can tolerate worst-case transient faults. In our model, nodes are finite-state and strongly anonymous, which means not only that they do not have unique IDs, but also that they do not have innate ability to determine whether two messages come from the same source. This condition well reflects the scenario of ad hoc networks consisting of identical nodes. In Section 2, we give formal definitions of the new concepts that we use to extend the original model. In Section 3, we present a powerful technique to facilitate the design and analysis of protocols by allowing the use of nondeterministic transitions. A large family of behaviors called elastic behaviors is defined that includes all behaviors we consider in this paper. We show that nondeterminism in protocols does not increase the class of elastic behaviors that have self-stabilizing implementations. In Section 4, we introduce a framework for composing certain self-stabilizing protocols.

3 Self-stabilizing Population Protocols 3 From Section 5 to Section 9, we give self-stabilizing protocols for various problems. As a simple example, we describe a self-stabilizing token circulation protocol in a ring with a pre-selected leader. The protocol resembles Dijkstra s k-state mutual-exclusion algorithm [Dijkstra 1974] but uses only O(1) bits per node. We describe a self-stabilizing 2-hop coloring protocol which colors the nodes such that no node has two neighbors colored the same given a bound on the number of neighbors. Given the coloring protocol, we show how to direct an undirected ring. We also give a self-stabilizing protocol which constructs a spanning tree in regular graphs using O(log D) bits per node, where D is the diameter of the network. To remove the assumption of a pre-selected leader in some protocols, we construct a family of leader-election protocols, each corresponding to a class of rings. We also show that self-stabilizing leader election is generally impossible in our model without some restriction on topology. In Section 10, we conclude with a brief summary of results and directions for further research. 1.1 Other Related Work Self-stabilizing systems were first introduced by Dijkstra [Dijkstra 1974]. In his seminal paper, Dijkstra gives three protocols to achieve process mutual-exclusion in rings in a self-stabilizing way. Leader election and token management are fundamental problems in self-stabilization and have been extensively studied in various other models. Mayer, Ofek, Ostrovsky, and Yung [Mayer et al. 1992] give a constant-space probabilistic protocol for a self-stabilizing round-robin token management scheme on an anonymous bidirectional ring of identical processors, assuming an external timeout mechanism to detect deadlocks. Itkis, Lin, and Simon [Itkis et al. 1995] present a deterministic constant-space self-stabilizing protocol for leader election on uniform bidirectional asynchronous rings of prime size. In their model, there is a central daemon that picks an enabled processor each time to make an atomic move. The chosen processor can read the states of its two neighbors at the same time to determine its next state. Gouda and Haddix [Gouda and Haddix 1996] present a self-stablizing token circulation algorithm on unidirectional rings with one distinguished node. Each node in their algorithm has eight states. Higham and Myers [Higham and Myers 1999] give a randomized self-stabilizing algorithm that solves token circulation and leader election on anonymous, uniform, synchronous, and unidirectional rings of arbitrary but known size, in which each processor state and message has size in O(log n). Dolev, Israeli, and Moran [Dolev et al. 1997] present a self-stabilizing leader election protocol that tolerates addition or deletion of processors and links. Their protocol uses O(log n) bits per node. Beauquier, Gradinariu, and Johnen [Beauquier et al. 1999] present a silent and deterministic self-stabilizing leader-election protocol requiring constant memory space on unidirectional, ID-based rings where the ID values are bounded. A protocol is silent if from an arbitrary configuration the system reaches a configuration after which the communication registers of each node remain constant. They also prove a nonconstant lower bound on space for self-stabilizing leader-election in unidirectional anonymous rings under a weak fairness assumption. Herman [Herman 1990] proposes a probabilistic synchronous self-stabilizing tokencirculation algorithm for identical nodes in an odd ring. Johnen [Johnen 2004]

4 4 Dana Angluin et al. presents a randomized self-stabilizing token circulation protocol on unidirectional anonymous rings. Fairness is enforced by randomization and the fair circulation of privileges. The scheduler can only choose nodes that hold a privilege token to make the next step. Itkis and Levin [Itkis and Levin 1994] present a self-stabilizing leader-election protocol for asynchronous networks of identical nameless nodes with arbitrary topology. In their model, each node s state consists of bits and pointers to immediate neighbors. The bits of a node x are visible to any neighbor y, and y can detect whether a pointer of x points to x or to y. Each node can detect a neighbor whose state satisfies a given property, set a pointer to it, and change state based on the above information. Our impossibility result for leader election in connected interaction graphs with arbitrary topology in Section 9 shows that their model and ours differ. However, it is an open problem whether our model can simulate theirs in some special classes of interaction graphs. [Griggs and Yeh 1992] introduces the graph labeling problem with conditions at distance 2. The communication networks community has studied variants of this problem, for applications such as assigning radio frequency ranges or time slots to wireless-signal transmitters to avoid interference. Herman and Tixeuil [Herman and Tixeuil 2004] describe a randomized self-stabilizing coloring algorithm for wireless sensor networks. Although they consider ad hoc networks and do not assume each node has prior knowledge of its neighborhood, the nodes have unique identifiers. Under the assumption of a known upper bound of neighborhood size, their algorithm uses a small set of colors to label the communication graph. This is a generalization of the renaming problem [Attiya et al. 1987]. Gradinariu and Johnen [Gradinariu and Johnen 2001] give a probabilistic solution for neighborhood unique naming in anonymous networks. No explicit identifiers are assumed in the model, however, each node has the ability to associate incoming messages with neighbors, possibly by physical communication links. Moscibroda and Wattenhofer [Moscibroda and Wattenhofer 2005] present another randomized coloring algorithm for radio networks. Their algorithm has the property that nodes can join the network asynchronously. The algorithm is not self-stabilizing and also assumes the existence of unique identifiers to let a receiver recognize whether or not two different messages are sent by the same sender. We study a similar 2-hop coloring problem which requires distinct neighbors of each node receive different colors, but two adjacent nodes can have the same color as long as they do not share any neighbor. We impose a strong anonymity condition: A node does not have the innate ability to distinguish different neighbors. To our knowledge no existing protocol is applicable in this model. In Section 6, we give a self-stabilizing 2-hop coloring protocol given a known degree bound. A direct application is to assign local identifiers so that nodes are able to refer to specific neighbors, whereas such an ability is implicitly assumed in the above mentioned coloring algorithms. 2. BASIC MODEL In the population protocols model, a network is represented by a directed graph G = (V, E) with n vertices numbered 0 through n 1 and no multi-edges or selfloops. In this paper, all network graphs are assumed to be weakly connected.

5 Self-stabilizing Population Protocols 5 Each vertex represents a finite-state sensing device, and an edge (u, v) indicates the possibility of a communication between u and v in which u is the initiator and v is the responder. The distinct roles of the two devices in an interaction is a fundamental assumption in our model. An undirected communication graph refers to a network in which for every edge (u, v), interactions of the forms (u, v) and (v, u) are both possible. When presenting protocols in the population protocols model in the rest of this paper, we abbreviate population protocol to protocol in order to avoid verbosity. Readers who are interested in the relationship between population protocols and more traditional message-passing protocols could refer to [Angluin et al. 2007] for a detailed treatment. A protocol P (Q, C, X, Y, O, δ) consists of a finite set of states Q, a set of initial configurations C, a finite set X of input symbols, an output function O : Q Y, where Y is a finite set of output symbols, and a transition function δ mapping each element of (Q X) (Q X) to a nonempty subset of Q Q. If (p, q ) δ((p, x), (q, y)), we call ((p, x), (q, y)) (p, q ) a transition. The transition function, and the protocol, is deterministic if δ((p, x), (q, y)) always contains just one pair of states. The inputs provide a way for a protocol to interact with an external entity, be it the environment, a user, or another protocol. If X is empty, the protocol does not accept input. A configuration is a mapping C : V Q and an input assignment is a mapping α : V X. The state of each device in the network is given by C and the input is given by α. If X is empty, α is also empty, and C specifies a configuration. A trace T G (Z) on a graph G(V, E) is an infinite sequence of assignments from V to the symbol set Z: T G = λ 0, λ 1,... where λ i is an assignment from V to Z. Z is called the alphabet of T G. If Z = X, we say T G is an input trace of the protocol. A trace is called a constant trace if it is a sequence of the same assignment. Let C and C be configurations, α be an input assignment, and u, v be distinct nodes. We say that (C, α) goes to C via pair e = (u, v), denoted (C, α) e C, if the pair (C (u), C (v)) is in δ((c(u), α(u)), (C(v), α(v))) and for all w V {u, v} we have C (w) = C(w). We say that (C, α) can go to C in one step, denoted (C, α) C, if (C, α) e C for some edge e E. If α is empty, we simply write C e C and C C respectively. Given an input trace IT = α 0, α 1,... we write C C if there is a sequence of configurations C = C 0, C 1,..., C k = C, such that (C i, α i ) C i+1 for all i, 0 i < k, in which case we say that C is reachable from C given input trace IT. The same notation is used for protocols that do not accept inputs. An execution is an infinite sequence of configurations and input assignments (C 0, α 0 ), (C 1, α 1 ),... such that C 0 C and for each i, (C i, α i ) C i+1. We extend the output function O to take a configuration C and produce an output assignment O(C) defined by O(C)(v) = O(C(v)). Let σ = (C 0, α 0 ), (C 1, α 1 ),..., (C i, α i ),... be an execution of P. We define the output trace of an execution as OT (σ) = O(C 0 ), O(C 1 ),..., O(C i ),.... Unlike most models in the literature, in population protocols fairness is a global property, therefore we call this fairness condition global fairness. Definition 2.1 Global Fairness. An execution is fair if for every α, C and C

6 6 Dana Angluin et al. such that (C, α) C, if (C, α) occurs infinitely often in the execution, then C also occurs infinitely often in the execution. An execution is generated by an infinite sequence of interactions. Intuitively, if the interactions in this sequence are chosen by an adversarial scheduler in accordance with the global fairness condition, the scheduler can not prevent an interaction from occurring infinitely often in a given configuration and input assignment unless that configuration-input pair occurs only finitely many times. Our definitions are actually slightly weaker. Our notion of execution specifies only the resulting configuration of each transition, not the actual transition that causes that result. In case two different transitions lead to the same result (as can happen for example with no-op transitions), the execution only shows the resulting configuration, not which transition led to that result. Similarly, our formal definition of global fairness does not insist that a particular transition be activated in a certain configuration-input pair; it requires only that the configuration that would result, were the transition to be activated, must eventually occur. Note that we do not require that it ever occur as the very next configuration. One important use of global fairness is to show that if a certain execution fragment is possible from a given infinitely-occurring configuration, then the configuration that would result from executing that fragment must also occur infinitely often in the execution, subject to some contraints on the inputs. Theorem 2.2. Let σ be an execution that satisfies global fairness, and assume C 0 occurs infinitely often in σ. Let σ = (C 0, α 0 ), (C 1, α 1 ),..., (C k, α k ) be an execution fragment. Suppose the α i s are such that if C i occurs infinitely often in σ, then (C i, α i ) occurs infinitely often in σ ( 0 i < k). Then C k occurs infinitely often in σ. Proof. Global fairness implies that if (C k 1, α k 1 ) occurs infinitely often in σ, then C k occurs infinitely often in σ. The result follows by an easy induction on k. A self-stabilizing system can start at an arbitrary configuration and eventually exhibit good behavior. We define a behavior B on a network G(V, E) to be a set of traces on G that have the same alphabet. We write B(Z) to be explicit about the common alphabet Z. A behavior B is constant if every trace in B is constant. If given the constraint that every input trace is contained in some behavior B in (X), the output trace of every fair execution of a protocol P (Q, C, X, Y, O, δ) starting from any configuration in C is in some behavior B out (Y ), we say P is an implementation of output behavior B out given input behavior B in. If P does not have any restriction on inputs, we simply say P is an implementation of B out. Given a behavior B(Z), we define the corresponding stable behavior B s (Z) = Z B(Z). Thus, an execution in a stable behavior has a completely arbitrary finite prefix followed by an execution with the desired properties. If P (Q, C, X, Y, O, δ) is an implementation of B s, and C is the set of all possible configurations, we say that P is a self-stabilizing implementation of B. 3. NONDETERMINISTIC PROTOCOLS

7 Self-stabilizing Population Protocols 7 In section 2, we gave the definition of deterministic protocol and nondeterministic protocol. Nondeterminism in this model is different from nondeterminism in computation theory. A nondeterministic Turing machine is allowed to always guess the correct choice of multiple possible steps. In the execution of a population protocol, the choice is made by an adversarial scheduler who is only limited by global fairness. We define the repetition closure of a sequence t to be the set of sequences obtainable from t by repeating each element one or more times. In other words, given any sequence t = a 1 a 2... a i..., the repetition closure R(t) is a + 1 a a+ i... in regular expression notation. We extend the definition of R to a behavior B by taking the union of R(t) for all t B. We say a behavior B is elastic if B = R(B). We show below that for elastic behaviors nondeterministic protocols are not more powerful than deterministic ones, in the sense that if there exists a nondeterministic selfstabilizing implementation of an elastic behavior, there also exists a deterministic version. We only consider networks of at least three nodes. We construct a compiler to convert every nondeterministic protocol to a deterministic one. To preserve self-stabilization, the compiler itself must be selfstabilizing. Let P 1 be a nondeterministic protocol with states Q, input alphabet X, and transition function δ. We describe a simulation of P 1 that works in graphs with at least three vertices. Let m be the maximum cardinality of any of the sets δ((q, x), (q, x )) for q, q Q and x, x X. For each q, q Q and x, x X, select an arbitrary surjective function f (q,x),(q,x ) mapping {0, 1,..., m 1} to δ((q, x), (q, x )). We describe a protocol P 2 to simulate each step of P 1 by multiple deterministic steps. The state components used in P 1 only change in the last of the corresponding steps in P 2. The state consists of three components: (1) a state q Q, (2) a mark, which we call a nondeterminizer token (abbreviated as token from here on for simplicity), or its absence, (3) a choice counter, consisting of an integer between 0 and m 1 inclusive. There are four types of transition rules in P 2 : Rule 1. (([q c], x), ([q c ], x )) ([q c], [q c ]) Rule 2. (([q c], x), ([q c ], x )) ([q c], [q (c + 1)]) Rule 3. (([q c], x), ([q c ], x )) ([q (c + 1)], [q c ]) Rule 4. (([q c], x), ([q c ], x )) ([r c], [r c ]) where the increments are made modulo m and (r, r ) = f (q,x),(q,x )(c) is the pair of states in δ((q, x), (q, x )). Thus, in transition rule 4, the value of the choice counter of the initiator is used to make a deterministic choice of an element of δ((q, x), (q, x )). The role of the tokens is to hop around the graph incrementing choice counters as they go. The first three transition rules accomplish this purpose. Transition rule 4 ensure that deadlock is impossible: even if we start from a configuration with no tokens, the rule will generate new tokens. Transition rule 1 ensure that the tokens have room to move around by merging two adjacent tokens.

8 8 Dana Angluin et al. We call the shared state component of P 1 and P 2 the q component. If C 1 is a configuration in P 1, and C 2 is a configuration in P 2, we say C 1 C 2 if each node in C 1 has the same q component as the corresponding node in C 2. Lemma 3.1. Assume a connected network with n 2 vertices. Starting from an arbitrary configuration, every globally fair execution of P 2 eventually reaches a point after which the number of tokens in every configuration is between 1 and n 1. Proof. Assume the initial configuration contains at least one token. If there are n tokens, the next interaction will remove one of them, because only the first transition rule is applicable. Starting from a configuration with at most n 1 tokens, it is impossible to generate the nth token, because the transitions that generates new tokens (rule 4) is applicable only when two nodes without the token interact. It is also impossible for all the tokens to disappear, because the number of tokens only decrease when two merge into one by applying transitions of rule 1. If the initial configuration does not contain any token, the next interaction will generate one, because only rule 4 is applicable. Therefore, after the first step, there will be at least 1 and at most n 1 tokens. It is never possible thereafter to generate the nth token, nor is it possible for all tokens to disappear. Lemma 3.2. Assume a connected network with n 2 vertices. Starting from a configuration with at least one and at most n 1 tokens, a token can be generated at any node without changing the q component of any node. Proof. The only transitions that change the q component are of rule 4 which require that both the initiator and the responder do not have a token. The token can be moved to any node by applying the other transition rules. In particular, transition rule 2 and rule 3 move a token in either direction on an arbitrary edge with an existing token on one end and no token on the other. Lemma 3.3. In a connected network of at least three nodes, for any possible step (C 1, α) C 1 of P 1 and any C 2 such that there is at least one and at most n 1 tokens in C 2 and C 1 C 2, where n is the number of nodes, there exists C 2 such that C 1 C 2 and an admissible sequence of steps of P 2 from (C 2, α) to C 2 given the constant input trace with input assignment α. Proof. Let (u, v) be the activated edge, and ((q 1, x 1 ), (q 2, x 2 )) (r 1, r 2 ) be the transition in P 1 corresponding to the step (C 1, α) C 1. We show there exists a sequence of steps in P 2 that starts from (C 2, α) and reaches some C 2 where C 2 C 2. We construct a sequence of steps using rules 1 3 to reach a configuration where the states of u and v are [q 1 c 1 ] and [q 2 c 2 ] respectively, f (q1,x 1),(q 2,x 2)(c 1 ) = (r 1, r 2 ), and no q component of any state has changed. A final activation of (u, v) results in the desired configuration C 2. First, we apply the sequence guaranteed by Lemma 3.2 to place a token at v without changing the q component of any node. If there is now a token at u, activate (u, v) twice; otherwise activate (u, v) once. Now there is one token at u and no token at v.

9 Self-stabilizing Population Protocols 9 Next, activate (u, v) repeatedly. The token moves back and forth between u and v, and c 1 cycles through all possible values. Stop when c 1 assumes a value such that f (q1,x 1),(q 2,x 2)(c 1 ) = (r 1, r 2 ). Now the token is at u. Next, activate edges without changing the q component of any node so as to leave both u and v without tokens. There are two cases. (1) If u is adjacent to another node w (w v), we remove the token from u by repeatedly activating the edge connecting u and w. The number of activations depends on the direction of the edge and whether w also has a token. (2) If v is the only neighbor of u, then v is adjacent to another node w (w v) since we assume the network has at least three nodes and is connected. Activate (u, v) once to move the token to v. We remove the token from v by repeatedly activating the edge connecting v and w. Again, the number of interactions depends on the direction of the edge and whether w also has a token. Now, neither u nor v has a token. Activate edge (u, v). Rule 4 applies, and the resulting configuration C 2 has identical q components with C 1; hence, C 1 C 2. Lemma 3.4. For any step (C 2, α) C 2 in an execution of P 2 in which the q component of some node is changed, there exist configurations C 1 and C 1 of P 1 such that C 1 C 2, C 1 C 2, and (C 1, α) C 1 is a transition of P 1. Proof. The only transitions in P 2 that change the q component of some node are applications of rule 4 which by definition is derived from the transitions in P 1. Therefore for every possible step that applies rule 4, there exists a corresponding possible step in P 1. Theorem 3.5. If a nondeterministic protocol P 1 is a self-stabilizing implementation of a behavior B on a connected network of at least three vertices given a constant behavior B, there exists a deterministic protocol P 2 that is a self-stabilizing implementation of R(B) given B. Proof. Let P 2 be the protocol from our construction. Let Π q : [qmc] q be the projection that maps states of P 2 to states of P 1 by erasing all but the q component. Extend Π q in the natural way to map configurations, sets of configurations, and executions of P 2 to the corresponding objects of P 1. Let E 2 be an execution of P 2. From Lemma 3.4, Π q (E 2 ) is contained in the repetition closure R(E 1 ) for some execution E 1 of P 1. Let A be the set of all possible configurations of P 2, and let B A be the set of all configurations in which the number of tokens is between 1 and n 1, where n is the number of nodes. Obviously, Π q (A) = Π q (B). From Lemma 3.4, for any execution E 2 of P 2 starting from a configuration in B, there exists an execution E 1 of P 1, such that Π q (E 2 ) R(E 1 ). From Lemma 3.1, every fair execution of P 2 has a suffix in which every configuration is in B. The above shows that for any fair execution E 2 of P 2, there exists an execution E 1 of P 1 such that Π q (E 2 ) has a suffix in R(E 1 ). Next, we show that E 1 is a fair execution of P 1. Let C 1 be a configuration of P 1, (C 1, α) C 1 a transition of P 1, and suppose C 1 occurs infinitely often in E 1. There is some configuration C 2 with C 1 C 2

10 10 Dana Angluin et al. that occurs infinitely often in E 2. From Lemma 3.3, there exists a configuration C 2 of P 2 such that C 1 C 2 and C 2 can be reached from (C 2, α) by an admissible sequence of steps of P 2 given the constant input trace with input assignment α. By Theorem 2.2, since E 2 is fair, C 2 occurs infinitely often in E 2. Then C 1 occurs infinitely often in E 1. Thus, E 1 satisfies global fairness, as desired. Theorem 3.5 immediately follows from the definition of behavior and that the output of each node is determined by its state. If B is an elastic behavior, B = R(B). The following corollary is immediate: Corollary 3.6. If a nondeterministic protocol P 1 is a self-stabilizing implementation of an elastic behavior B given a constant behavior B, there exists a deterministic protocol P 2 that is a self-stabilizing implementation of B given B. 4. PROTOCOL COMPOSITION In complex protocols, sometimes it is desirable to utilize existing protocols as modules. Parallel execution of protocols is easily achieved by taking the Cartesian product of their state sets and updating the states for each protocol independently when a transition occurs. In this section we introduce one technique of protocol composition in our model and show how to compose protocols P 1, P 2,..., P n, with some restrictions. For n = 2, assuming P 1 and P 2 access different components of the node s state, we run P 1 and P 2 in parallel, except that whenever P 2 is executed, it uses the current output of P 1 as its current input. When an edge is fired, it is nondeterministically determined which protocol gets the chance to execute. Recall that a behavior is constant if it contains only constant traces. Theorem 4.1. Suppose B 1 is a constant behavior. If P 2 is a self-stabilizing implementation of an elastic behavior B 2 given input behavior B 1, and P 1 is a selfstabilizing implementation of B 1, the composition of P 1 and P 2 (written as P 1 P 2 ) is a self-stabilizing implementation of B 2. Proof. Let S = C 0, C 1,... be any fair execution of P 1 P 2. Define the projection Π 1 (C) of a configuration C to be the sub-configuration produced by taking each node s state components that are accessed by P 1. Π 2 is defined similarly for P 2. Define S = C 0, C 1,... the maximal subsequence of S in which for each i, the transition immediately after C i is defined in P 1. S = C 0, C 1,... is defined similarly for P 2. Because P 1 is self-stabilizing, and Π 1 (C 0), Π 1 (C 1),... is a fair execution of P 1, there exists some i such that the output trace of Π 1 (C i ), Π 1(C i+1 ),... satisfies B 1. Let C j be any configuration that appears after C i in S, and let C j, C j+1,... be the sequence starting from C j in S. Because the output trace of P 1 in C j, C j+1,... is constant and satisfies B 1, Π 2 (C j ), Π 2(C j+1 ),... is a fair execution of P 2 whose output trace satisfies B 2. Because B 2 is elastic, the output trace of P 1 P 2 in the subsequence of S starting from C j satisfies B 2. Therefore P 1 P 2 is a self-stabilizing implementation of B 2.

11 Self-stabilizing Population Protocols TOKEN-CIRCULATION IN AN ORIENTED RING As a simple example, we discuss the token circulation problem in an interaction graph whose topology is an oriented ring. The protocol uses the same idea as in Dijkstra s first algorithm in [Dijkstra 1974], but we only use 2 colors (0 and 1). Readers from the self-stabilization community will find the protocol familiar. Definition 5.1. The token-circulation behavior T C on graph G(V, E) is the set of all traces t = β 0, β 1,... with alphabet {T, φ} such that: (1) For all m 0, v V such that β m (v) = T and u V {v}, β m (u) = φ. (2) For all 0 m < k < n, if v, w V (v w) such that β m (v) = β k (w) = β n (v) = T, then u V {v}, l such that m < l < n and β l (u) = T. (3) For all v V, β k (v) = T for infinitely many k. A node owns a token in a configuration if its output is T. For any trace in T C, exactly one node has a token in each configuration, and after a node releases a token, it does not obtain a token again until every other node has obtained a token once. We describe a self-stabilizing implementation of T C given the leader-election behavior LE. The description of a self-stabilizing implementation of LE is postponed to Section 9. Definition 5.2. The leader-election behavior LE on graph G = (V, E) is the set of all constant traces β, β,... such that for some v V, β(v) = L and for all u v, β(u) = N. Informally, there is a static node with the leader mark L, and all other nodes have the nonleader mark N in every configuration. Given the LE input behavior, one node receives input L and all other nodes receive input N. When two nodes interact, if the responder is the leader, it sets its label to the complement of the initiator s label; otherwise the responder copies the label from the initiator. If an interaction triggers a label change, a token is passed from the initiator to the responder. If a token is not present at the initiator, a new token is generated. Protocol 1 describes the process formally. Protocol 1 Self-stabilizing token circulation in rings Node states are pairs in {, } {0, 1}. indicates the presence of a token and indicates the absence of a token. The second component of a node is called the label of that node. The interaction rules are: Rule 1. (( b, N), ( b, L)) ( b, b) Rule 2. (( b, ), ( b, N)) ( b, b) We use the convention that on the left side of a rule matches any value for the component, that b on the left side matches either 0 or 1, and b means the complement of b. The output rules are T and φ. (Output T if and only if the first component is.)

12 12 Dana Angluin et al. Because each transition is independent of the presence or absence of tokens before the interaction, the token component of the state is only needed for production of the output symbol. In models with other conventions for specifying the location of the token, this extra state bit might not be needed. Generally, proving self-stabilization in our model involves proving two statements: there exist some legitimate configurations, beginning with which every possible execution has a suffix satisfying the desired behavior, and a legitimate configuration is reachable from any arbitrary configuration. The fairness condition guarantees that every fair execution eventually reaches a legitimate configuration. For Protocol 1, legitimate configurations are those in which every node has the same label. We establish the correctness of the protocol in the following lemmas: Lemma 5.3. Let C 0 be a configuration in which every node has the same label. Given the input behavior LE, the trace of every fair execution of Protocol 1 starting with C 0 has a suffix in T C. Proof. We define the direction of the edges to be clockwise and the opposite direction to be counter-clockwise. We call the leader node 0, and the sequence of nodes to the clockwise direction is 0, 1,..., n 1. We use (u, v) to refer to the directed edge that starts at u pointing to v. The only edge in C 0 that will cause state change is (n 1, 0) (by rule 1). When the edge is activated, node 0 obtains a token and is assigned a label that is different from all other nodes, and if node n 1 owns a token before the interaction, it surrenders the token. Suppose C 1 is the configuration immediately following C 0. Node 0 s label cannot change until node n 1 has the same label, and every other node u cannot change its label until the label of node u 1 is different from its own. Therefore u is the only node that could change its label (when edge (0, 1) is activated). If C 2 is the configuration immediately following C 1, it is easy to see that only (1, 2) will cause state change. In general, for any u (1 < u n), the following is true in C u : (1) u 1 owns a token. (2) For all v < u 1, v does not own a token. (3) The only edge that can cause state change is (u 1, u). Note that in C n every node again has the same label, and node n 1 is the only node that owns a token. Thus for u n, in C u, the only edge that can cause state change is (u 1 mod n, u mod n), and node u 1 mod n owns the unique token in the ring. Lemma 5.4. C 0 is reachable from any arbitrary configuration. Proof. We use the same naming convention as in the proof of Lemma 5.3. Let the scheduler activate (0, 1), (1, 2),..., (n 2, n 1) sequentially. An activation of (0, 1) can cause state change only when node 0 and node 1 have different labels, and the activation causes 1 to change its label to be the same as 0 s. In general, for 0 u < n 1, the activation of (u, u + 1) causes node u + 1 to copy the label of u if u and u + 1 don t already have the same label. After (u, u + 1) is activated, 0, 1,..., u + 1 have the same label. Therefore, after (n 2, n 1) is activated, nodes 0, 1,..., n 1 all have the same label.

13 Self-stabilizing Population Protocols 13 Theorem 5.5. Protocol 1 is a constant-space self-stabilizing implementation of output behavior T C given input behavior LE in an oriented ring. Theorem 5.5 follows from Lemma 5.3 and Lemma HOP COLORING IN BOUNDED-DEGREE GRAPHS To extend the token circulation algorithm to undirected rings, we need a protocol that imposes orientation on the ring. A necessary condition is that each node be able to recognize its two different neighbors. Here we describe a more general algorithm that enables each node in a degree-bounded graph to distinguish between its neighbors. Suppose an undirected graph has degree bound d. We want to color the graph such that any two nodes adjacent to the same node have different colors. After a graph is properly colored, the neighbors of any node have different colors and thus are distinguishable. Notice that two nodes directly connected by an edge can have the same color if they are not both adjacent to the same node. More precisely, for each node v, if u and w are distinct neighbors of v, then u and w must receive different colors. We call such a pair (u, w) a 2-hop pair, and we call a node-coloring in which every 2-hop pair is distinctly colored a 2-hop coloring. It is not difficult to see that g = d(d 1)+1 colors suffice, for the related graph whose edges are the 2-hop pairs of the original graph has degree bound d = d(d 1), and any graph of degree bound d can be colored (in the ordinary sense) with at most d + 1 colors. Definition 6.1. The 2-hop coloring behavior 2HC on graph G = (V, E) with color set Γ is the set of constant traces λ, λ,... where the alphabet of λ is Γ and whenever u, v, w V are such that (u, v) E and (v, w) E and u w, we have λ(u) λ(w). We give two protocols for solving 2-hop coloring for a graph with degree bound d using g colors. The first is presented as a nondeterministic protocol, from which the nondeterminism can be removed by applying Corollary 3.6. The second is a deterministic protocol that incorporates a simplified nondeterminizer sufficient to solve the problem at hand. 6.1 Nondeterministic protocol In this and the following sections, we describe our algorithms by specifying the interaction between two adjacent nodes u and v when the edge (u, v) is activated. The pseudocode shows how the state variables of both u and v are updated in an interaction as if the state variables of both nodes lived in a common memory. This can easily be translated into our formal model whereby each node updates its own state variables based on their current values and the values of the other node s state variables, which are supplied to it as inputs during the interaction. In Protocol 2, each node u has the following state components: color u An integer encoding the color of node u. Its value is between 0 and g 1. A bit array whose size is g, indexed by colors. F u Node u outputs the current value of its color u component.

14 14 Dana Angluin et al. Protocol 2 Nondeterministic 2-hop coloring with degree bound d For each node u: State variables: color u and F u Output: color u The interaction between an initiator u and a responder v: 1: if F u [color v ] F v [color u ] then possibly conflicting colors 2: color u color u nondeterministic coloring 3: F u [color v ] F v [color u ] 4: else valid coloring 5: F u [color v ] F u [color v ] 6: F v [color u ] F v [color u ] 7: end if The statement color u color u means one of the g possible colors is nondeterministically assigned as the new color of u. In other words, in this case there are g rules that can be applied to (u, v), each assigning a distinct color to u. Distinct nodes u and w are violating nodes if they have the same color and share a common neighbor. Formally, they are violating if color u = color w and there are edges (u, v) and (v, w) for some v. We also apply the term violating to a single node u if there exists a node w that it is in violation with. Let (u, v) be an edge in the network. We say that the edge is synchronized if F u [color v ] = F v [color u ]. We also apply the term synchronized to the pair of nodes u and v, and we refer to the complementary case as unsynchronized. A configuration is legitimate if it satisfies two safety conditions: (1) [No color violations] There are no violating nodes. (2) [Synchronization] There are no unsynchronized edges. To get an intuition for the protocol, consider a legitimate configuration, and suppose network edge (u, v) is activated. The edge is synchronized, so lines 5 and 6 of the protocol are are executed. These do not change the color of any node. Although they do flip the bits F u [color v ] and F v [color u ], all edges remain synchronized. Clearly (u, v) is still synchronized, as is any edge (x, y) that does not share a node with (u, v). The other edges that touch u and v also remain synchronized because of the first safety condition. If (u, w) is such an edge, then color v color w, so F u [color w ] is not affected by the change to F u [color v ], and (u, w) remains synchronized. Similarly, each edge (v, w) with w u remains synchronized. Hence, the new configuration is legitimate. Now suppose the original configuration is not legitimate, (u, v) and (v, w) are network edges, and u and w have the same color c. Suppose edge (u, v) is activated. If it was synchronized before the activation, line 6 is executed and bit F v [c] is flipped. This causes v s synchronization status with w to change. In particular, if (v, w) was synchronized before the u-v interaction, then it loses its synchronization as a result. On the other hand, if (u, v) was not synchronized before the activation, then line 2 is executed and u is non-deterministically recolored, possibly causing it to become violating. In either case, though, the edge (u, v) is synchronized in the resulting

15 Self-stabilizing Population Protocols 15 configuration. We will show that after enough nondeterministic recolorings, the protocol will eventually reach a legitimate configuration. We now make these arguments more precise. Lemma 6.2. The trace of any execution of Protocol 2 starting from a legitimate configuration is in 2HC. Proof. Let C 0 be a legitimate configuration and (u, v) be any edge. Suppose (u,v) C 0 C 1. Because (u, v) is synchronized in C 0, no color change occurs, and both F u [color v ] and F v [color u ] are complemented in the interaction. Hence, C 0 and C 1 have the same coloring, and (u, v) is synchronized in C 1. Since C 1 has no color violations, v is the only neighbor of u with color color v, and u is the only neighbor of v with color u. Therefore, the bits F u [color v ] and F v [color u ] which differ between C 0 and C 1 do not affect the synchronization status of any other edges, which remain synchronized in C 1. Thus, C 1 is legitimate and has the same coloring as C 0. Because C 0 and (u, v) are chosen arbitrarily, we conclude that every configuration in any execution starting from any legitimate configuration is legitimate, and all configurations in any such execution have the same coloring. It follows that the sequence of outputs is constant, and the trace is in 2HC. Lemma 6.3. Starting from an arbitrary configuration, there exists a finite execution fragment of Protocol 2 that reaches a legitimate configuration. Proof. We describe a two-phase procedure to construct a path to a legitimate configuration from an arbitrary configuration. The first phase corrects color violations, and the second phase synchronizes all network edges without changing node colors. Phase 1 consists of a sequence of subphases σ(u), one for each node u. Each subphase consist of a sequence of interactions as described below. The subphases are constructed sequentially and refer to the configuration that results from the previous subphases. Subphase σ(u) is empty if u is not violating at the start of the subphase, so assume now that u is violating. We construct a sequence of activations σ(u) that change u s color so that it is no longer violating but do not change the color of any other node. Since u is violating, there are edges (u, v) and (v, w) such that color u = color w. σ(u) consists of the activations described by the cases below, which are based on the values of F u [color v ], F v [color u ] = F v [color w ], and F w [color v ]: (1) F u [color v ] F v [color u ]. Let the scheduler activate (u, v), so that line 2 is executed. Because u can be the endpoint of at most d(d 1) 2-hop paths, there exists at least one color color u that differs from the color of every 2- hop neighbor of u. Let u choose color u as its new color. This removes the color violation from u. Line 3 sets F u [color v ] F v [color u], so u and v are synchronized after the interaction. (2) F u [color v ] = F v [color u ] = F w [color v ]. Let the scheduler activate (v, w). This will flip F v [color w ] and F w [color v ], causing (u, v) to become unsynchronized. Now continue with case 1.

16 16 Dana Angluin et al. (3) F u [color v ] = F v [color u ] F w [color v ]. Let the scheduler activate (v, u) and (v, w) sequentially. This will cause F u [color v ] and F w [color v ] to flip once and F v [color u ] to flip twice, leaving it unchanged. Afterwards, (v, w) is synchronized but (u, v) is unsynchronized. Now continue with case 1. Each subphase σ(u) corrects the color of u and does not introduce any new color violations, so the configuration at the end of phase 1 satisfies the first safety condition. In the second phase, we remove violations of the synchronization condition. For each unsynchronized edge (u, v), let the scheduler activate (u, v). If line 2 of the protocol is taken, let node u choose not to change its color. Because u will set F u [color v ] F v [color u ], the edge (u, v) becomes synchronized. Since the configuration after phase 1 has no color violations, the neighbors of each node now all have distinct colors. Therefore synchronizing an edge does not introduce new unsynchronized edges. Because the second phase does not modify the colors, after all unsynchronized edges are corrected, the system is in a legitimate configuration. The following theorem, which is an immediate consequence of Lemmas 6.2 and 6.3 and Theorem 2.2, establishes the correctness of the protocol. Theorem 6.4. For each d, there exists a constant-space self-stabilizing implementation of the 2-hop coloring behavior in undirected communication graphs of degree bounded by d. According to Corollary 3.6, there exists a deterministic version of this protocol. However, the full machinery of Corollary 3.6 is not needed to make the protocol work. In the following section, we show how a simpler deterministic protocol suffices. 6.2 Deterministic protocol One way to turn the nondeterministic Protocol 2 into a deterministic one is to change the coloring rule at line 2, as shown in Protocol 3. Here, r u is a local bit that flips whenever u acts as the initiator in an interaction. Consecutive repeated executions of line 2 cause u s color to cycle through all possible values, but an interaction when r u = 0 will synchronize the interacting nodes without changing their colors, needed for the construction of Lemma 6.6. Lemma 6.5. The trace of any execution of Protocol 3 starting from a legitimate configuration is in 2HC. Proof. Because the set of possible traces of Protocol 3 is a subset of that of Protocol 2, Lemma 6.5 follows from Lemma 6.2. Lemma 6.6. Starting from an arbitrary configuration, there exists a finite execution fragment of Protocol 3 that reaches a legitimate configuration. Proof. We use a two-phase procedure similar to the proof of Lemma 6.3 to construct a path to a legitimate configuration from an arbitrary configuration. As before, phase 1 consists of a sequence of subphases σ(u), one for each node u. Each subphase consists of a sequence of interactions as described below. The